ifconfig: Markup nits.

MFC after: 3 days
Reviewed by: imp, allanjude
Differential Revision: https://reviews.freebsd.org/D45209

ifconfig: Add format shortcuts.

MFC after: 1 week
Reviewed by: imp
Differential Revision: https://reviews.freebsd.org/D45166

carp: document the new VRRPv3 support

Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D44776

ifconfig tunnelfib is implemented in wg(4)

MFC After: 1 week
Reviewed by: imp, zlei, kevans
Pull Request: https://github.com/freebsd/freebsd-src/pull/1186

ifconfig.8: add missing "be"

Reviewed by: allanjude, bjk
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D44022

ifconfig: a typo fixed in the man page

PR: 276878

ifconfig: add -D option to print driver name for interface

Add -D option to add the drivername and unit number to ifconfig output
for normal display, including -a. Use ifconfig_get_orig_name() from
libifconfig to fetch the name. Note that this is the original name
for many drivers, but not for some exceptions like epair (which appends
'a' or 'b' to the unit number). epair interface pairs both display
as "epair0", etc. Make -v imply -D; might as well be fully verbose.

MFC after: 1 week
Reviewed by: zlei, kp
Differential Revision: https://reviews.freebsd.org/D42721

sbin: Remove ancient SCCS tags.

Remove ancient SCCS tags from the tree, automated scripting, with two
minor fixup to keep things compiling. All the common forms in the tree
were removed with a perl script.

Sponsored by: Netflix

pfsync: Document the transport over IPv6 feature

On D40102 we implemented support for transport over IPv6 but the
documentation was not updated to reflect the new feature.

Clarify what is available and how it can be used.

MFC after: 1 week
Sponsored by: InnoGames GmbH
Differential Revision: https://reviews.freebsd.org/D42505

pfsync: Provide documentation regarding message version

Reviewed by: kp
MFC after: 3 days
Sponsored by: InnoGames GmbH
Differential Revision: https://reviews.freebsd.org/D42235

Remove $FreeBSD$: one-line nroff pattern

Remove /^\.\\"\s*\$FreeBSD\$$\n/

ifconfig.8: Document limitation of groupname

Approved by: kp
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D40645

ifconfig(8): add the dotted format for MAC addresses.

MFC after: 2 weeks
PR: 261572

ifconfig(8): Teach ifconfig to attach and run itself in a jail

Add -j <jail> flag to ifconfig to allow ifconfig to attach and run inside a
jail. This allow parent to configure network interfaces of its children
even if ifconfig is not available in child's tree (e.g. Linux Jails)

Reviewed by: emaste, khng, melifaro
Event: Kitchener-Waterloo Hackathon 202305
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D40213

carp: document peer/peer6 and mcast/mcast6 in the relevant man pages

Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D38943

ifconfig.8: Improve readability of vlanproto's description

Sponsored by: Klara Inc.
MFC after: 1 week

Fix wrong capitalization in man page references.

ifconfig.8: cleanup reminiscence about long gone ppp(4)

Replace ppp(4) removed since FreeBSD 8.0-RELEASE with vlan(4).
While here, remove commented out reference to non-existing "egress"
interface group hiding since initial import of interface groups
from OpenBSD in 2006.

vxlan: Add support for socket ioctls SIOC[SG]TUNFIB

Submitted by: Luiz Amaral <email@luiz.eng.br>
PR: 244004
Differential Revision: https://reviews.freebsd.org/D32820
MFC after: 2 weeks

ifconfig.8: Polish

MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D35686

ifconfig.8: Prefer consistent terminologies

Reviewed by: pauamma_gundo.com, email_luiz.eng.br
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D35384

ifconfig.8: Document -g all and -G all

The special group name "all" selects all the interfaces.

MFC after: 3 days

ifconfig.8: reflect removal of FDDI and Token Ring

Reviewed By: pauamma
Differential Revision: https://reviews.freebsd.org/D35409

arp: Implement sticky ARP mode for interfaces.

Provide sticky ARP flag for network interface which marks it as the
"sticky" one similarly to what we have for bridges. Once interface is
marked sticky, any address resolved using the ARP will be saved as a
static one in the ARP table. Such functionality may be used to prevent
ARP spoofing or to decrease latencies in Ethernet networks.

The drawbacks include potential limitations in usage of ARP-based
load-balancers and high-availability solutions such as carp(4).

The implemented option is disabled by default, therefore should not
impact the default behaviour of the networking stack.

Sponsored by: Conclusive Engineering sp. z o.o.
Reviewed By: melifaro, pauamma_gundo.com
Differential Revision: https://reviews.freebsd.org/D35314
MFC after: 2 weeks

ifconfig: Fix spelling error

s/discreet/discrete

Reported by: Diane Bruce

ifconfig.8: Note that -l accepts -g in addition to -d and -u

Fixes: 5533c5046ada ifconfig.8: Update -l synopsis
MFC after: 3 days

ifconfig.8: Update -l synopsis

The -g flag can be used together with the -l flag.

MFC after: 2 weeks

ifconfig.8: Document "ifconfig -g groupname"

"ifconfig -g groupname" prints a list of interface names,
which could be confusing, because it differs from
the behavior of "ifconfig -a -g groupname".

While here, add two examples showing the difference between
"ifconfig -a -g groupname" and "ifconfig -g groupname".

Fixes: 0dad3f0e1512 Import interface groups from OpenBSD.
MFC after: 2 weeks

ifconfig.8: Remove commented-out Xr eon 5

This reference has been present in the manual page since the initial
import of BSD 4.4 Lite sbin Sources. It's time for it to be removed.

MFC after: 2 weeks

ifconfig.8: Remove remaining Xerox Network Systems(tm) bits

Support for Xeros Network Systems seems to be long gone. There is no
reason to keep this in the manual page.

MFC after: 2 weeks

ifconfig.8: Simplify examples by using canonical parameters

Also, use Bd instead of Dl for multi line examples.

MFC after: 2 weeks

ifconfig.8: Mark address_family as optional in synopsis

Commands like "ifconfig wlan0 up" are valid. There is no need to always
specify the address family.

MFC after: 2 weeks

ifconfig.8: Improve description of the address argument

- Split paragraphs for clarity.
- Add an example of setting a random MAC address.

MFC after: 2 weeks

ifconfig.8: Improve readability of address_family documentation

Also, move the description of the special case of "ifconfig -l ether" to
the description of the -l flag.

MFC after: 2 weeks

ifconfig.8: Fix quoting

Obtained from: https://github.com/freebsd/freebsd-src/commit/67d77afb0dde9aa627635a0c4e28a8fa5a64db6c#r69907135
Fixes: 67d77afb0dde ifconfig.8: Do not use ``'' for quoting
MFC after: 2 weeks

ifconfig.8: Clean up markup of "state" parameter

MFC after: 2 weeks

ifconfig.8: Make the -f flag description compact

- Remove extraneous examples
- Apply "-compact" to the list macros so that it is possible to fit the
definitions of the types and formats in one terminal screen.

MFC after: 2 weeks

ifconfig.8: Do not use ``'' for quoting

MFC after: 2 weeks

ifconfig.8: Clean up the channel parameter description

MFC after: 2 weeks

ifconfig.8: Add section headers to the parameters section

MFC after: 2 weeks

ifconfig.8: Clean up -n documentation

MFC after: 2 weeks

ifconfig.8: Clean up -k documentation

MFC after: 2 weeks

ifconfig.8: Clean up -C and -v documentation

MFC after: 2 weeks

ifconfig.8: Clean up -l documentation

MFC after: 2 weeks

ifconfig.8: Clean up -G & -g documentation

MFC after: 2 weeks

ifconfig.8: Clean up documentation of -a, -d, and -u

MFC after: 2 weeks

ifconfig.8: Clean up -L documentation

MFC after: 2 weeks

ifconfig.8: Clean up -m documentation

MFC after: 2 weeks

ifconfig.8: Clean up formatting of -f documentation

This change is about moving the -f documentation into the right place in
the manual. Also, document the IFCONFIG_FORMAT variable in the
ENVIRONMENT section.

MFC after: 2 weeks

ifconfig.8: Move options sections to the top

In order to clean up the layout of the manual page, let's keep
parameters in the end of the DESCRIPTION section. This patch does not
change any content, it's meant to only move the content around before
refactoring.

MFC after: 2 weeks

ifconfig.8: Deduplicate groupname documentation

-G and -g flags are already described somewhere else in the manual.

MFC after: 2 weeks

ifconfig.8: Document that -k can be used with -a

MFC after: 2 weeks

ifconfig.8: Improve -f synopsis

- There is no need to mention in the synopsis that -f can be a list of
comma-separated type:format pairs. Let's keep it simple instead.
- Mention that -f can be supplied multiple times.
- Add -f to other entries in the synopsis where it can be used.

MFC after: 2 weeks

ifconfig.8: Document the synopsis of -C

As documented, the -C flag can only be used on its own. Any other
command modifiers and flags are ignored when -C is used. Reflect that in
synopsis.

MFC after: 2 weeks

ifconfig.8: Show that -g groupname can be used on its own

MFC after: 2 weeks

ifconfig.8: Cluster together short flags

MFC after: 2 weeks

ifconfig.8: Simplify -G & -g synopsis

MFC after: 1 week

ifconfig.8: Add capability codes descriptions from handbook

We document capability codes (the CAPS field of "ifconfig wlan0 scan")
in both ifconfig(8) and the handbook. The list is more complete in the
manual page, while the descriptions of individual capabilities are more
detailed in the handbook.

In order to reduce content duplication and bit rot, let's move
handbook's details to the manual page and reference the manual page
whenever necessary.

Reviewed by: debdrup
Reviewed by: Pau Amma
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D34662

ifconfig.8: Add the missing option -vlanhwcsum

Commit 9b776960c3276c47528435f343b3b6d0143113a8 documented a new option
vlanhwcsum but missed the opposite one -vlanhwcsum.

Reviewed by: kp
Differential Revision: https://reviews.freebsd.org/D32887

ifconfig: Minor documentation fix

Fix what appears to have been a small copy/paste typo in ifconfig(8)'s
documentation (man page and header file).

Not that it matters anymore.

Reference: Table I-2 in IEEE Std 802.1Q-2014.

PR: 255557
Submitted by: Jose Luis Duran <jlduran@gmail.com>
MFC after: 1 week

Catch up with 6edfd179c86: mechanically rename IFCAP_NOMAP to IFCAP_MEXTPG.

Originally IFCAP_NOMAP meant that the mbuf has external storage pointer
that points to unmapped address. Then, this was extended to array of
such pointers. Then, such mbufs were augmented with header/trailer.
Basically, extended mbufs are extended, and set of features is subject
to change. The new name should be generic enough to avoid further
renaming.

ifconfig: add vlanproto "qiniq" as an alias for "802.1ad"

QinQ is better known by this name, so accept it as an alias

Reported-by: Mike Geiger
Reviewed-by: melifaro, hselasky, rpokala
MFC-with: 366917
Sponsored-by: Klara Inc.
Differential-Revision: https://reviews.freebsd.org/D28245

ifconfig.8: Improve formatting of -f in synopsis

MFC after: 3 days

Remove Tn macros from ifconfig.8

MFC after: 3 days

Support hardware rate limiting (pacing) with TLS offload.

- Add a new send tag type for a send tag that supports both rate
limiting (packet pacing) and TLS offload (mostly similar to D22669
but adds a separate structure when allocating the new tag type).

- When allocating a send tag for TLS offload, check to see if the
connection already has a pacing rate. If so, allocate a tag that
supports both rate limiting and TLS offload rather than a plain TLS
offload tag.

- When setting an initial rate on an existing ifnet KTLS connection,
set the rate in the TCP control block inp and then reset the TLS
send tag (via ktls_output_eagain) to reallocate a TLS + ratelimit
send tag. This allocates the TLS send tag asynchronously from a
task queue, so the TLS rate limit tag alloc is always sleepable.

- When modifying a rate on a connection using KTLS, look for a TLS
send tag. If the send tag is only a plain TLS send tag, assume we
failed to allocate a TLS ratelimit tag (either during the
TCP_TXTLS_ENABLE socket option, or during the send tag reset
triggered by ktls_output_eagain) and ignore the new rate. If the
send tag is a ratelimit TLS send tag, change the rate on the TLS tag
and leave the inp tag alone.

- Lock the inp lock when setting sb_tls_info for a socket send buffer
so that the routines in tcp_ratelimit can safely dereference the
pointer without needing to grab the socket buffer lock.

- Add an IFCAP_TXTLS_RTLMT capability flag and associated
administrative controls in ifconfig(8). TLS rate limit tags are
only allocated if this capability is enabled. Note that TLS offload
(whether unlimited or rate limited) always requires IFCAP_TXTLS[46].

Reviewed by: gallatin, hselasky
Relnotes: yes
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D26691

ifconfig.8: Remove spurious commas

Correct misuse of commas/parentheses in an enumeration that makes the
number of actual parameters more important than expected.

PR: 250526
Submitted by: Samy Mahmoudi <samy.mahmoudi__gmail_com>
MFC after: 1 week

Add support for IP over infiniband, IPoIB, to lagg(4). Currently only
the failover protocol is supported due to limitations in the IPoIB
architecture. Refer to the lagg(4) manual page for how to configure
and use this new feature. A new network interface type,
IFT_INFINIBANDLAG, has been added, similar to the existing
IFT_IEEE8023ADLAG .

ifconfig(8) has been updated to accept a new laggtype argument when
creating lagg(4) network interfaces. This new argument is used to
distinguish between ethernet and infiniband type of lagg(4) network
interface. The laggtype argument is optional and defaults to
ethernet. The lagg(4) command line syntax is backwards compatible.

Differential Revision: https://reviews.freebsd.org/D26254
Reviewed by: melifaro@
MFC after: 1 week
Sponsored by: Mellanox Technologies // NVIDIA Networking

Add support for stacked VLANs (IEEE 802.1ad, AKA Q-in-Q).

802.1ad interfaces are created with ifconfig using the "vlanproto" parameter.
Eg., the following creates a 802.1Q VLAN (id #42) over a 802.1ad S-VLAN
(id #5) over a physical Ethernet interface (em0).

ifconfig vlan5 create vlandev em0 vlan 5 vlanproto 802.1ad up
ifconfig vlan42 create vlandev vlan5 vlan 42 inet 10.5.42.1/24

VLAN_MTU, VLAN_HWCSUM and VLAN_TSO capabilities should be properly
supported. VLAN_HWTAGGING is only partially supported, as there is
currently no IFCAP_VLAN_* denoting the possibility to set the VLAN
EtherType to anything else than 0x8100 (802.1ad uses 0x88A8).

Submitted by: Olivier Piras
Sponsored by: RG Nets
Differential Revision: https://reviews.freebsd.org/D26436

Fix a few mandoc issues

- no blank before trailing delimiter
- whitespace at end of input line
- sections out of conventional order
- normalizing date format
- AUTHORS section without An macro

Add two new ifnet capabilities for hw checksumming and TSO for VXLAN traffic.

These are similar to the existing VLAN capabilities.

Reviewed by: kib@
Sponsored by: Chelsio Communications
Differential Revision: https://reviews.freebsd.org/D25873

ifconfig(8): remove duplicate line from man page

Reported by: Weitian LI <liweitianux@live.com>
Sponsored by: Klara Inc.

ifconfig(8): make it possible to filter output by interface group.

Now options -g/-G allow to select/unselect interfaces by groups
in the "ifconfig -a" output just like already existing -d/-u.

Examples:

to exclude loopback from the list: ifconfig -a -G lo
to show vlan interfaces only: ifconfig -a -g vlan
to show tap interfaces that are up: ifconfig -aug tap

Arguments to -g/-G may be shell patterns and both may be specified.
Later options -g/-G override previous ones.

MFC after: 2 weeks
Relnotes: yes
Differential Revision: https://reviews.freebsd.org/D25029

ifconfig.8: fix cpability and flag descriptions for list scan / sta

Some capability descriptions under list scan actually described flags.
Some capability descriptions were missing.
Some flag descriptions under list sta actually described capabilites.

Reviewed by: adrian
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D25014

ifconfig(8): spell "groupname" consistently with SYNOPSYS.

MFC after: 1 week

lagg: Clean up handling of the rr_limit option.

- Don't allow an unprivileged user to set the stride. [1]
- Only set the stride under the softc lock.
- Rename the internal fields to accurately reflect their use. Keep
ro_bkt to avoid changing the user API.
- Simplify the implementation. The port index is just sc_seq / stride.
- Document rr_limit in ifconfig.8.

Reported by: Ilja Van Sprundel <ivansprundel@ioactive.com> [1]
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D22857

Add kernel-side support for in-kernel TLS.

KTLS adds support for in-kernel framing and encryption of Transport
Layer Security (1.0-1.2) data on TCP sockets. KTLS only supports
offload of TLS for transmitted data. Key negotation must still be
performed in userland. Once completed, transmit session keys for a
connection are provided to the kernel via a new TCP_TXTLS_ENABLE
socket option. All subsequent data transmitted on the socket is
placed into TLS frames and encrypted using the supplied keys.

Any data written to a KTLS-enabled socket via write(2), aio_write(2),
or sendfile(2) is assumed to be application data and is encoded in TLS
frames with an application data type. Individual records can be sent
with a custom type (e.g. handshake messages) via sendmsg(2) with a new
control message (TLS_SET_RECORD_TYPE) specifying the record type.

At present, rekeying is not supported though the in-kernel framework
should support rekeying.

KTLS makes use of the recently added unmapped mbufs to store TLS
frames in the socket buffer. Each TLS frame is described by a single
ext_pgs mbuf. The ext_pgs structure contains the header of the TLS
record (and trailer for encrypted records) as well as references to
the associated TLS session.

KTLS supports two primary methods of encrypting TLS frames: software
TLS and ifnet TLS.

Software TLS marks mbufs holding socket data as not ready via
M_NOTREADY similar to sendfile(2) when TLS framing information is
added to an unmapped mbuf in ktls_frame(). ktls_enqueue() is then
called to schedule TLS frames for encryption. In the case of
sendfile_iodone() calls ktls_enqueue() instead of pru_ready() leaving
the mbufs marked M_NOTREADY until encryption is completed. For other
writes (vn_sendfile when pages are available, write(2), etc.), the
PRUS_NOTREADY is set when invoking pru_send() along with invoking
ktls_enqueue().

A pool of worker threads (the "KTLS" kernel process) encrypts TLS
frames queued via ktls_enqueue(). Each TLS frame is temporarily
mapped using the direct map and passed to a software encryption
backend to perform the actual encryption.

(Note: The use of PHYS_TO_DMAP could be replaced with sf_bufs if
someone wished to make this work on architectures without a direct
map.)

KTLS supports pluggable software encryption backends. Internally,
Netflix uses proprietary pure-software backends. This commit includes
a simple backend in a new ktls_ocf.ko module that uses the kernel's
OpenCrypto framework to provide AES-GCM encryption of TLS frames. As
a result, software TLS is now a bit of a misnomer as it can make use
of hardware crypto accelerators.

Once software encryption has finished, the TLS frame mbufs are marked
ready via pru_ready(). At this point, the encrypted data appears as
regular payload to the TCP stack stored in unmapped mbufs.

ifnet TLS permits a NIC to offload the TLS encryption and TCP
segmentation. In this mode, a new send tag type (IF_SND_TAG_TYPE_TLS)
is allocated on the interface a socket is routed over and associated
with a TLS session. TLS records for a TLS session using ifnet TLS are
not marked M_NOTREADY but are passed down the stack unencrypted. The
ip_output_send() and ip6_output_send() helper functions that apply
send tags to outbound IP packets verify that the send tag of the TLS
record matches the outbound interface. If so, the packet is tagged
with the TLS send tag and sent to the interface. The NIC device
driver must recognize packets with the TLS send tag and schedule them
for TLS encryption and TCP segmentation. If the the outbound
interface does not match the interface in the TLS send tag, the packet
is dropped. In addition, a task is scheduled to refresh the TLS send
tag for the TLS session. If a new TLS send tag cannot be allocated,
the connection is dropped. If a new TLS send tag is allocated,
however, subsequent packets will be tagged with the correct TLS send
tag. (This latter case has been tested by configuring both ports of a
Chelsio T6 in a lagg and failing over from one port to another. As
the connections migrated to the new port, new TLS send tags were
allocated for the new port and connections resumed without being
dropped.)

ifnet TLS can be enabled and disabled on supported network interfaces
via new '[-]txtls[46]' options to ifconfig(8). ifnet TLS is supported
across both vlan devices and lagg interfaces using failover, lacp with
flowid enabled, or lacp with flowid enabled.

Applications may request the current KTLS mode of a connection via a
new TCP_TXTLS_MODE socket option. They can also use this socket
option to toggle between software and ifnet TLS modes.

In addition, a testing tool is available in tools/tools/switch_tls.
This is modeled on tcpdrop and uses similar syntax. However, instead
of dropping connections, -s is used to force KTLS connections to
switch to software TLS and -i is used to switch to ifnet TLS.

Various sysctls and counters are available under the kern.ipc.tls
sysctl node. The kern.ipc.tls.enable node must be set to true to
enable KTLS (it is off by default). The use of unmapped mbufs must
also be enabled via kern.ipc.mb_use_ext_pgs to enable KTLS.

KTLS is enabled via the KERN_TLS kernel option.

This patch is the culmination of years of work by several folks
including Scott Long and Randall Stewart for the original design and
implementation; Drew Gallatin for several optimizations including the
use of ext_pgs mbufs, the M_NOTREADY mechanism for TLS records
awaiting software encryption, and pluggable software crypto backends;
and John Baldwin for modifications to support hardware TLS offload.

Reviewed by: gallatin, hselasky, rrs
Obtained from: Netflix
Sponsored by: Netflix, Chelsio Communications
Differential Revision: https://reviews.freebsd.org/D21277

finish the pcp feature, but documenting it in the man page...

Add an external mbuf buffer type that holds multiple unmapped pages.

Unmapped mbufs allow sendfile to carry multiple pages of data in a
single mbuf, without mapping those pages. It is a requirement for
Netflix's in-kernel TLS, and provides a 5-10% CPU savings on heavy web
serving workloads when used by sendfile, due to effectively
compressing socket buffers by an order of magnitude, and hence
reducing cache misses.

For this new external mbuf buffer type (EXT_PGS), the ext_buf pointer
now points to a struct mbuf_ext_pgs structure instead of a data
buffer. This structure contains an array of physical addresses (this
reduces cache misses compared to an earlier version that stored an
array of vm_page_t pointers). It also stores additional fields needed
for in-kernel TLS such as the TLS header and trailer data that are
currently unused. To more easily detect these mbufs, the M_NOMAP flag
is set in m_flags in addition to M_EXT.

Various functions like m_copydata() have been updated to safely access
packet contents (using uiomove_fromphys()), to make things like BPF
safe.

NIC drivers advertise support for unmapped mbufs on transmit via a new
IFCAP_NOMAP capability. This capability can be toggled via the new
'nomap' and '-nomap' ifconfig(8) commands. For NIC drivers that only
transmit packet contents via DMA and use bus_dma, adding the
capability to if_capabilities and if_capenable should be all that is
required.

If a NIC does not support unmapped mbufs, they are converted to a
chain of mapped mbufs (using sf_bufs to provide the mapping) in
ip_output or ip6_output. If an unmapped mbuf requires software
checksums, it is also converted to a chain of mapped mbufs before
computing the checksum.

Submitted by: gallatin (earlier version)
Reviewed by: gallatin, hselasky, rrs
Discussed with: ae, kp (firewalls)
Relnotes: yes
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D20616

Change ed(4), ep(4), and fxp(4) examples to em(4).

ed(4) and ep(4) have been removed. fxp(4) remains popular in older
systems, but isn't as future proof as em(4).

Reviewed by: bz, jhb
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D20311

Select lacp egress ports based on NUMA domain

This change creates an array of port maps indexed by numa domain
for lacp port selection. If we have lacp interfaces in more than
one domain, then we select the egress port by indexing into the
numa port maps and picking a port on the appropriate numa domain.

This is behavior is controlled by the new ifconfig use_numa flag
and net.link.lagg.use_numa sysctl/tunable (both modeled after the
existing use_flowid), which default to enabled.

Reviewed by: bz, hselasky, markj (and scottl, earlier version)
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D20060

ifconfig.4, lagg.4: fix documentation bug: -use_flowid needs to be used
to force local hash computation and disable usage of RSS hash
provided by driver.

PR: 234242
MFC after: 1 week

Fix description for the "autoconf" ifconfig(8) flag; it's an address
property, not something you set for an interface.

MFC after: 2 weeks

Document in ifconfig(8) that gre(4) accepts tunnel commands

- Also ensure wording is consistent for gif and gre

Reviewed by: wblock
Differential Revision: https://reviews.freebsd.org/D5667

The .Cm macro usage fixed.

PR: 217977
Submitted by: tobik

Renumber copyright clause 4

Renumber cluase 4 to 3, per what everybody else did when BSD granted
them permission to remove clause 3. My insistance on keeping the same
numbering for legal reasons is too pedantic, so give up on that point.

Submitted by: Jan Schaumann <jschauma@stevens.edu>
Pull Request: https://github.com/freebsd/freebsd/pull/96

Implement kernel support for hardware rate limited sockets.

- Add RATELIMIT kernel configuration keyword which must be set to
enable the new functionality.

- Add support for hardware driven, Receive Side Scaling, RSS aware, rate
limited sendqueues and expose the functionality through the already
established SO_MAX_PACING_RATE setsockopt(). The API support rates in
the range from 1 to 4Gbytes/s which are suitable for regular TCP and
UDP streams. The setsockopt(2) manual page has been updated.

- Add rate limit function callback API to "struct ifnet" which supports
the following operations: if_snd_tag_alloc(), if_snd_tag_modify(),
if_snd_tag_query() and if_snd_tag_free().

- Add support to ifconfig to view, set and clear the IFCAP_TXRTLMT
flag, which tells if a network driver supports rate limiting or not.

- This patch also adds support for rate limiting through VLAN and LAGG
intermediate network devices.

- How rate limiting works:

1) The userspace application calls setsockopt() after accepting or
making a new connection to set the rate which is then stored in the
socket structure in the kernel. Later on when packets are transmitted
a check is made in the transmit path for rate changes. A rate change
implies a non-blocking ifp->if_snd_tag_alloc() call will be made to the
destination network interface, which then sets up a custom sendqueue
with the given rate limitation parameter. A "struct m_snd_tag" pointer is
returned which serves as a "snd_tag" hint in the m_pkthdr for the
subsequently transmitted mbufs.

2) When the network driver sees the "m->m_pkthdr.snd_tag" different
from NULL, it will move the packets into a designated rate limited sendqueue
given by the snd_tag pointer. It is up to the individual drivers how the rate
limited traffic will be rate limited.

3) Route changes are detected by the NIC drivers in the ifp->if_transmit()
routine when the ifnet pointer in the incoming snd_tag mismatches the
one of the network interface. The network adapter frees the mbuf and
returns EAGAIN which causes the ip_output() to release and clear the send
tag. Upon next ip_output() a new "snd_tag" will be tried allocated.

4) When the PCB is detached the custom sendqueue will be released by a
non-blocking ifp->if_snd_tag_free() call to the currently bound network
interface.

Reviewed by: wblock (manpages), adrian, gallatin, scottl (network)
Differential Revision: https://reviews.freebsd.org/D3687
Sponsored by: Mellanox Technologies
MFC after: 3 months

Add an option called "random" that combined with "ether" can generate a
random MAC address for an Ethernet interface.

PR: 211984
Submitted by: pi@
Reviewed by: gnn, cem, jhb, lidl, rpokala, wblock
Approved by: wblock (manpages)

Bump date on ifconfig(8) and vlan(4) to reflect the changes made
on revision r301496.

Add support to priority code point (PCP) that is an 3-bit field
which refers to IEEE 802.1p class of service and maps to the frame
priority level.

Values in order of priority are: 1 (Background (lowest)),
0 (Best effort (default)), 2 (Excellent effort),
3 (Critical applications), 4 (Video, < 100ms latency),
5 (Video, < 10ms latency), 6 (Internetwork control) and
7 (Network control (highest)).

Example of usage:
root# ifconfig em0.1 create
root# ifconfig em0.1 vlanpcp 3

Note:
The review D801 includes the pf(4) part, but as discussed with kristof,
we won't commit the pf(4) bits for now.
The credits of the original code is from rwatson.

Differential Revision: https://reviews.freebsd.org/D801
Reviewed by: gnn, adrian, loos
Discussed with: rwatson, glebius, kristof
Tested by: many including Matthew Grooms <mgrooms__shrew.net>
Obtained from: pfSense
Relnotes: Yes

Address feedback from hrs@ re: r301059 (ifconfig subnet mask)

- Use NI_MAXHOST to size buffers for getnameinfo()
- remove non-standard 'full' inet6 address printing
- remove 'no scope' option
- use strchr(3) to optimize replacing separator character in lladdrs

Reviewed by: gnn, jhb
Differential Revision: https://reviews.freebsd.org/D2856

ifconfig(8) now supports some output formatting options

specified by the -f flag or IFCONFIG_FORMAT environment variable, the user
can request that inet4 subnet masks be printed in CIDR or dotted-quad
notation, in addition to the traditional hex output.
inet6 prefixes can be printed in CIDR as well.

For more documentation see the ifconfig(8) man page.

PR: 169072
Requested by: seanc, marcel, brd, many others
Reviewed by: gnn, jhb (earlier version)
Relnotes: yes
Sponsored by: ScaleEngine Inc.
Differential Revision: https://reviews.freebsd.org/D2856

Add Documentation for missing ifconfig(8) flags

autoconf / -autoconf
deprecated / -deprecated
pltime
vltime

PR: 209822
Submitted by: Sevan Janiyan <venture37@geeklan.co.uk>
MFC after: 2 weeks

Add sysctl to control LACP strict compliance default

Add net.link.lagg.lacp.default_strict_mode which defines
the default value for LACP strict compliance for created
lagg devices.

Also:
* Add lacp_strict option to ifconfig(8).
* Fix lagg(4) creation examples.
* Minor style(9) fix.

MFC after: 1 week

Make LAG LACP fast timeout tunable through IOCTL.

Differential Revision: D3300
Submitted by: LN Sundararajan <lakshmi.n at msystechnologies>
Reviewed by: wblock, smh, gnn, hiren, rpokala at panasas
MFC after: 2 weeks
Sponsored by: Panasas

Add an ability accept encapsulated packets from different sources by one
gif(4) interface. Add new option "ignore_source" for gif(4) interface.
When it is enabled, gif's encapcheck function requires match only for
packet's destination address.

Differential Revision: https://reviews.freebsd.org/D2004
Obtained from: Yandex LLC
MFC after: 2 weeks
Sponsored by: Yandex LLC

Add new socket ioctls SIOC[SG]TUNFIB to set FIB number of encapsulated
packets on tunnel interfaces. Add support of these ioctls to gre(4),
gif(4) and me(4) interfaces. For incoming packets M_SETFIB() should use
if_fib value from ifnet structure, use proper value in gre(4) and me(4).

Differential Revision: https://reviews.freebsd.org/D2462
No objection from: #network
MFC after: 2 weeks
Sponsored by: Yandex LLC

- Remove ND6_IFF_IGNORELOOP. This functionality was useless in practice
because a link where looped back NS messages are permanently observed
does not work with either NDP or ARP for IPv4.

- draft-ietf-6man-enhanced-dad is now RFC 7527.

Discussed with: hiren
MFC after: 3 days

- Implement loopback probing state in enhanced DAD algorithm.

- Add no_dad and ignoreloop per-IF knob. no_dad disables DAD completely,
and ignoreloop is to prevent infinite loop in loopback probing state when
loopback is permanently expected.

mdoc: improvements to SEE ALSO.

Prefix all the vxlan ifconfig commands so they are unique

And rehook ifvxlan back into the build.

Add vxlan interface

vxlan creates a virtual LAN by encapsulating the inner Ethernet frame in
a UDP packet. This implementation is based on RFC7348.

Currently, the IPv6 support is not fully compliant with the specification:
we should be able to receive UPDv6 packets with a zero checksum, but we
need to support RFC6935 first. Patches for this should come soon.

Encapsulation protocols such as vxlan emphasize the need for the FreeBSD
network stack to support batching, GRO, and GSO. Each frame has to make
two trips through the network stack, and each frame will be at most MTU
sized. Performance suffers accordingly.

Some latest generation NICs have begun to support vxlan HW offloads that
we should also take advantage of. VIMAGE support should also be added soon.

Differential Revision: https://reviews.freebsd.org/D384
Reviewed by: gnn
Relnotes: yes

Virtualize lagg(4) cloner. This change fixes a panic when tearing down
if_lagg(4) interfaces which were cloned in a vnet jail.

Sysctl nodes which are dynamically generated for each cloned interface
(net.link.lagg.N.*) have been removed, and use_flowid and flowid_shift
ifconfig(8) parameters have been added instead. Flags and per-interface
statistics counters are displayed in "ifconfig -v".

CR: D842

The lagg(4) interface is based on trunk(4) interface from OpenBSD.
The FreeBSD is the only system that has the FEC protocol, that is a simple alias
to loadbalance protocol and does not implement the ancient Cisco FEC standard.

From now on, we remove the fec protocol from the documentation and keep the FEC
code only for compatibility.

Phabric: D539
Reviewed by: glebius, thompsa
Approved by: glebius
Sponsored by: QNAP Systems Inc.

Add laggproto broadcast, it allows sends frames to all ports of the lagg(4) group
and receives frames on any port of the lagg(4).

Phabric: D549
Reviewed by: glebius, thompsa
Approved by: glebius
Obtained from: OpenBSD
Sponsored by: QNAP Systems Inc.

Add the ability to set `prefer_source' flag to an IPv6 address.
It affects the IPv6 source address selection algorithm (RFC 6724)
and allows override the last rule ("longest matching prefix") for
choosing among equivalent addresses. The address with `prefer_source'
will be preferred source address.

Obtained from: Yandex LLC
MFC after: 1 month
Sponsored by: Yandex LLC

Make the description of the "no_prefer_iface" flag easier to understand.

Reviewed by: Silence on -net@ and from ume@

mdoc: remove superfluous paragraph macros.

Style cleanups on ifconfig.8
fix igor warnings
uppercase all instances of Ethernet
replace bad e.g.

CR: D91
Approved by: wblock (mentor)

improve ifconfig(8) man page by describing special behaviour of -l ether

PR: docs/187644
Submitted by: Andrew Merenbach (original patch)
Approved by: bcr (mentor)

Remove AppleTalk support.

AppleTalk was a network transport protocol for Apple Macintosh devices
in 80s and then 90s. Starting with Mac OS X in 2000 the AppleTalk was
a legacy protocol and primary networking protocol is TCP/IP. The last
Mac OS X release to support AppleTalk happened in 2009. The same year
routing equipment vendors (namely Cisco) end their support.

Thus, AppleTalk won't be supported in FreeBSD 11.0-RELEASE.

Remove IPX support.

IPX was a network transport protocol in Novell's NetWare network operating
system from late 80s and then 90s. The NetWare itself switched to TCP/IP
as default transport in 1998. Later, in this century the Novell Open
Enterprise Server became successor of Novell NetWare. The last release
that claimed to still support IPX was OES 2 in 2007. Routing equipment
vendors (e.g. Cisco) discontinued support for IPX in 2011.

Thus, IPX won't be supported in FreeBSD 11.0-RELEASE.

Provide a working example line for an interface with 1 address running
with CARP.

Currently, we've got a problem that interface isn't IFF_UP at the time
we assign it a redundant address, and the latter gets stuck in INIT state.
Additional SIOCSIFFLAGS from ifconfig(8) kicks it to a working state.

A proper fix is kernel side and appeared to be non-trivial, not to be
checked in before 10.0-RELEASE.

Submitted by: Ole Myhre <ole.myhre dataoppdrag.no>

mdoc sweep

Add no_prefer_iface option.
It stops treating the address on the interface as special by source
address selection rule even when the interface is outgoing interface.
This is desired in some situation.

Requested by: hrs
Reviewed by: IHANet folks including hrs
MFC after: 1 week

Actually change "silent" to "silence" this time (reviewed by adri@).

MFC after: 1 week

Remove fifteen-year-old notes on media selection (suggested by simon@).
Add commas after "e.g." and "i.e.". Change "silent" to "silence" in
wireless create section (reviewed by adri@).

MFC after: 1 week

Add devd.conf(5) and devd(8) to SEE ALSO xrefs. Give users a pointer to
seemingly mysterious actions that are not done by ifconfig itself, but
by devd triggering on events caused by ifconfig.

PR: docs/173405
Submitted by: Mateusz Kwiatkowski <mateusz.kwiatkowski@atlashost.eu>
MFC after: 1 week

Remove "prefer_source" address selection option. FreeBSD has had an
implementation of RFC 3484 for this purpose for a long time and "prefer_source"
was never implemented actually. ND6_IFF_PREFER_SOURCE macro is left intact.

Remove repeated words.

It turns out that too many drivers are not only parsing the L2/3/4
headers for TSO but also for generic checksum offloading. Ideally we
would only have one common function shared amongst all drivers, and
perhaps when updating them for IPv6 we should introduce that.
Eventually we should provide the meta information along with mbufs to
avoid (re-)parsing entirely.

To not break IPv6 (checksums and offload) and to be able to MFC the
changes without risking to hurt 3rd party drivers, duplicate the v4
framework, as other OSes have done as well.

Introduce interface capability flags for TX/RX checksum offload with
IPv6, to allow independent toggling (where possible). Add CSUM_*_IPV6
flags for UDP/TCP over IPv6, and reserve further for SCTP, and IPv6
fragmentation. Define CSUM_DELAY_DATA_IPV6 as we do for legacy IP and
add an alias for CSUM_DATA_VALID_IPV6.

This pretty much brings IPv6 handling in line with IPv4.
TSO is still handled in a different way and not via if_hwassist.

Update ifconfig to allow (un)setting of the new capability flags.
Update loopback to announce the new capabilities and if_hwassist flags.

Individual driver updates will have to follow, as will SCTP.

Reported by: gallatin, dim, ..
Reviewed by: gallatin (glanced at?)
MFC after: 3 days
X-MFC with: r235961,235959,235958

MFp4 bz_ipv6_fast:

Allow tso4 and tso6 be set individually given we have the bits.
This will help with drivers not working as expected during the
transition time and later.

Sponsored by: The FreeBSD Foundation
Sponsored by: iXsystems

Reviewed by: gnn
MFC After: 1 week

Update man page date to the date of the last commit.

Approved by: adrian

* Added new command to ifconfig to activate Mesh Gate Announcement called
meshgate with corresponding explanation;

Approved by: adrian

Remove end of line whitespace introduced in previous commit.

Document syncdev, syncpeer and defer keywords for
pfsync(4) interfaces.

Remove trailing whitespace per mdoc lint warning

Disussed with: gavin
No objection from: doc
Approved by: joel
MFC after: 3 days

Fix typo and bump the document date which I also forgot.

Spotted by: Andrey Zonov

Add the ability to set which packet layers are used for the load balance hash
calculation.

Update bridge(4) default values.

PR: 164564
Submitted by: "Rudy (bulk)" <crapsh@monkeybrains.net>
MFC after: 2 weeks

Correct capitalization of "Hz" in user-visible text (manpages, printf(),
etc).

MFC after: 3 days

Adjust the VLAN section of the ifconfig(8) man page to better reflect
reality:

1. Only 12-bit VLAN Identifiers, not full 16-bit VLAN tags can be set using
ifconfig vlan.

2. When we mean VLAN Identifiers, spell it that way, rather than as VLAN tag.

MFC after: 3 days
Sponsored by: Adara Networks, Inc.

Allow toggling of IFCAP_VLAN_HWCSUM for hardware that supports checksum
offloading on vlans and document the new option.

MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation

A major overhaul of the CARP implementation. The ip_carp.c was started
from scratch, copying needed functionality from the old implemenation
on demand, with a thorough review of all code. The main change is that
interface layer has been removed from the CARP. Now redundant addresses
are configured exactly on the interfaces, they run on.

The CARP configuration itself is, as before, configured and read via
SIOCSVH/SIOCGVH ioctls. A new prefix created with SIOCAIFADDR or
SIOCAIFADDR_IN6 may now be configured to a particular virtual host id,
which makes the prefix redundant.

ifconfig(8) semantics has been changed too: now one doesn't need
to clone carpXX interface, he/she should directly configure a vhid
on a Ethernet interface.

To supply vhid data from the kernel to an application the getifaddrs(8)
function had been changed to pass ifam_data with each address. [1]

The new implementation definitely closes all PRs related to carp(4)
being an interface, and may close several others. It also allows
to run a single redundant IP per interface.

Big thanks to Bjoern Zeeb for his help with inet6 part of patch, for
idea on using ifam_data and for several rounds of reviewing!

PR: kern/117000, kern/126945, kern/126714, kern/120130, kern/117448
Reviewed by: bz
Submitted by: bz [1]

Bump date.

Add documentation for the new quiet time IE options.

Submitted by: Himali Patel <himali.patel@sibridgetech.com>
Sponsored by: Sibridge Technologies

- Document inet6 no_radr flag.
- Add descriptions of sysctl(8) variables which can control the default
configuration of the inet6 flags.

Approved by: re (kib)

Add infrastructure to allow all frames/packets received on an interface
to be assigned to a non-default FIB instance.

You may need to recompile world or ports due to the change of struct ifnet.

Submitted by: cjsp
Submitted by: Alexander V. Chernikov (melifaro ipfw.ru)
(original versions)
Reviewed by: julian
Reviewed by: Alexander V. Chernikov (melifaro ipfw.ru)
MFC after: 2 weeks
X-MFC: use spare in struct ifnet

Conditionally compile in the af_inet and af_inet6, af_nd6 modules.
If compiled in for dual-stack use, test with feature_present(3)
to see if we should register the IPv4/IPv6 address family related
options.

In case there is no "inet" support we would love to go with the
usage() and make the address family mandatory (as it is for anything
but inet in theory). Unfortunately people are used to
ifconfig IF up/down
etc. as well, so use a fallback of "link". Adjust the man page
to reflect these minor details.

Improve error handling printing a warning in addition to the usage
telling that we do not know the given address family in two places.

Reviewed by: hrs, rwatson
Sponsored by: The FreeBSD Foundation
Sponsored by: iXsystems
MFC after: 2 weeks

Correct 'list scan' description in the examples. The previous description
was incorrect - 'list scan' does not actually do a scan, but instead lists
the results of the background 'scan' cache.

Submitted by: Fabian Keil (freebsd-listen of fabiankeil de) (via email)
Discussed with: bschmidt
MFC after: 3 days

Bump date from previous commit.

Use 'list scan' in favor of 'scan', as 'scan' has a different purpose.

Pointed out by: bschmidt
MFC after: 1 day

Remove unneeded newline.

MFC after: 1 week

Add example of using 'scan' for wireless networks, similarly to
OpenBSD's ifconfig(8).

PR: 151952
Submitted by: Jared (rhyous of yahoo com)
MFC after: 1 week

A new jail(8) with a configuration file, to replace the work currently done
by /etc/rc.d/jail.

Fix typos, spelling, formatting and mdoc mistakes found by Nobuyuki while
translating these manual pages. Minor corrections by me.

Submitted by: Nobuyuki Koganemaru <n-kogane@syd.odn.ne.jp>

Fix typos and spelling mistakes.

Spelling fixes.

MFC r208077:
Document the 'short preamble' capability for 802.11bg.

Reviewed by: sam

Document the 'short preamble' capability for 802.11bg.

Reviewed by: sam
MFC after: 4 days

Bump man page date.

Fix typos.

Obtained from: DragonFlyBSD

MFC r204150:
Add TSO support on VLAN in fconfig(8).

Create the altix project branch. The altix project will add support
for the SGI Altix 350 to FreeBSD/ia64. The hardware used for porting
is a two-module system, consisting of a base compute module and a
CPU expansion module. SGI's NUMAFlex architecture can be an excellent
platform to test CPU affinity and NUMA-aware features in FreeBSD.

MFC 203052:

Add interface description capability as inspired by OpenBSD. Thanks for
rwatson@, jhb@, brooks@ and others for feedback to the old implementation!

Sponsored by: iXsystems, Inc.

Add TSO support on VLAN in fconfig(8).

Reviewed by: thompsa

Revised revision 199201 (add interface description capability as inspired
by OpenBSD), based on comments from many, including rwatson, jhb, brooks
and others.

Sponsored by: iXsystems, Inc.
MFC after: 1 month

MFC:

r197138:
- The ifconfig(8) command now supports NDP flags which are handled by ndp(8).

r198006:
- Use printb() to display the "nd6 options=" line.

Revert revision 199201 for now as it has introduced a kernel vulnerability
and requires more polishing.

Add interface description capability as inspired by OpenBSD.

MFC after: 3 months

MFC r197142:

Document accept_rev_ethip_ver and send_rev_ethip_ver flags of
EtherIP (gif(4) + if_bridge(4)).

Approved by: re (kib)

Fix several logic bugs in the previous IPv6 variable change and
re-add $ipv6_enable support for backward compatibility. From
UPDATING:

1. To use IPv6, simply define $ifconfig_IF_ipv6 like $ifconfig_IF
for IPv4. For aliases, $ifconfig_IF_aliasN should be used.
Note that both variables need the "inet6" keyword at the head.

Do not set $ipv6_network_interfaces manually if you do not
understand what you are doing. It is not needed in most cases.

$ipv6_ifconfig_IF and $ipv6_ifconfig_IF_aliasN still work, but
they are obsolete.

2. $ipv6_enable is obsolete. Use $ipv6_prefer and/or
"inet6 accept_rtadv" keyword in ifconfig(8) instead.

If you define $ipv6_enable=YES, it means $ipv6_prefer=YES and
all configured interfaces have "inet6 accept_rtadv" in the
$ifconfig_IF_ipv6. These are for backward compatibility.

3. A new variable $ipv6_prefer has been added. If NO, IPv6
functionality of interfaces with no corresponding
$ifconfig_IF_ipv6 is disabled by using "inet6 ifdisabled" flag,
and the default address selection policy of ip6addrctl(8)
is the IPv4-preferred one (see rc.d/ip6addrctl for more details).
Note that if you want to configure IPv6 functionality on the
disabled interfaces after boot, first you need to clear the flag by
using ifconfig(8) like:

ifconfig em0 inet6 -ifdisabled

If YES, the default address selection policy is set as
IPv6-preferred.

The default value of $ipv6_prefer is NO.

4. If your system need to receive Router Advertisement messages,
define "inet6 accept_rtadv" in $ifconfig_IF_ipv6. The rc(8)
scripts automatically invoke rtsol(8) when the interface becomes
UP. The Router Advertisement messages are used for SLAAC
(State-Less Address AutoConfiguration).

Document accept_rev_ethip_ver and send_rev_ethip_ver flags of
EtherIP (gif(4) + if_bridge(8)).

MFC after: 3 days

Improve flexibility of receiving Router Advertisement and
automatic link-local address configuration:

- Convert a sysctl net.inet6.ip6.accept_rtadv to one for the
default value of a per-IF flag ND6_IFF_ACCEPT_RTADV, not a
global knob. The default value of the sysctl is 0.

- Add a new per-IF flag ND6_IFF_AUTO_LINKLOCAL and convert a
sysctl net.inet6.ip6.auto_linklocal to one for its default
value. The default value of the sysctl is 1.

- Make ND6_IFF_IFDISABLED more robust. It can be used to disable
IPv6 functionality of an interface now.

- Receiving RA is allowed if ip6_forwarding==0 *and*
ND6_IFF_ACCEPT_RTADV is set on that interface. The former
condition will be revisited later to support a "host + router" box
like IPv6 CPE router. The current behavior is compatible with
the older releases of FreeBSD.

- The ifconfig(8) now supports these ND6 flags as well as "nud",
"prefer_source", and "disabled" in ndp(8). The ndp(8) now
supports "auto_linklocal".

Discussed with: bz and jinmei
Reviewed by: bz
MFC after: 3 days

Implementation of the upcoming Wireless Mesh standard, 802.11s, on the
net80211 wireless stack. This work is based on the March 2009 D3.0 draft
standard. This standard is expected to become final next year.
This includes two main net80211 modules, ieee80211_mesh.c
which deals with peer link management, link metric calculation,
routing table control and mesh configuration and ieee80211_hwmp.c
which deals with the actually routing process on the mesh network.
HWMP is the mandatory routing protocol on by the mesh standard, but
others, such as RA-OLSR, can be implemented.

Authentication and encryption are not implemented.

There are several scripts under tools/tools/net80211/scripts that can be
used to test different mesh network topologies and they also teach you
how to setup a mesh vap (for the impatient: ifconfig wlan0 create
wlandev ... wlanmode mesh).

A new build option is available: IEEE80211_SUPPORT_MESH and it's enabled
by default on GENERIC kernels for i386, amd64, sparc64 and pc98.

Drivers that support mesh networks right now are: ath, ral and mwl.

More information at: http://wiki.freebsd.org/WifiMesh

Please note that this work is experimental. Also, please note that
bridging a mesh vap with another network interface is not yet supported.

Many thanks to the FreeBSD Foundation for sponsoring this project and to
Sam Leffler for his support.
Also, I would like to thank Gateworks Corporation for sending me a
Cambria board which was used during the development of this project.

Reviewed by: sam
Approved by: re (kensmith)
Obtained from: projects/mesh11s

Add the "vnet" and "-vnet" options, to allow moving interfaces between
jails with VIMAGE.

Approved by: bz (mentor)

TDMA support for long distance point-to-point links using ath devices:
o add net80211 support for a tdma vap that is built on top of the
existing adhoc-demo support
o add tdma scheduling of frame transmission to the ath driver; it's
conceivable other devices might be capable of this too in which case
they can make use of the 802.11 protocol additions etc.
o add minor bits to user tools that need to know: ifconfig to setup and
configure, new statistics in athstats, and new debug mask bits

While the architecture can support >2 slots in a TDMA BSS the current
design is intended (and tested) for only 2 slots.

Sponsored by: Intel

Tiny wording nits.

MFC after: 1 week

- Import the HEAD csup code which is the basis for the cvsmode work.

o Typo fixes.

PR: docs/127866
Submitted by: Marius Korsmo

MIMO power save and RIFS; while here also update per-node state/flags for ampdu

Add support in ifconfig to control the vlan hardware filter feature.

Reviewed by: EvilSam and moi
MFC after:1 week

Fix typo.

recognize WPS ie's

Submitted by: "Chuck Tuffli" <chuck@tuffli.net>
MFC after: 1 week

change list wme to only print the channel parameters; to
get channel+bss use -v

correct description of how to clear a desired channel

Pointed out by: Chris Buechler
MFC after: 1 week

Add support for the optional key in the GRE header.

PR: kern/114714
Submitted by: Cristian KLEIN

Multi-bss (aka vap) support for 802.11 devices.

Note this includes changes to all drivers and moves some device firmware
loading to use firmware(9) and a separate module (e.g. ral). Also there
no longer are separate wlan_scan* modules; this functionality is now
bundled into the wlan module.

Supported by: Hobnob and Marvell
Reviewed by: many
Obtained from: Atheros (some bits)

explain that you must set a default transmit key for WEP

Submitted by: Jeremie Le Hen <jeremie@le-hen.org>
MFC after: 1 week

Wake On Lan (WOL) infrastructure

Submitted by: Stefan Sperling <stsp@stsp.name>
Reviewed by: brooks

Add an option to limit the number of source MACs that can be behind a bridge
interface. Once the limit is reached packets with unknown source addresses are
dropped until an existing host cache entry expires or is removed. Useful to
use with the STICKY cache option.

Sponsored by: miniSuperHappyDevHouse NZ

minor wireless-related corrections

MFC after: 1 week

Add a bridge interface flag called PRIVATE where any private port can not
communicate with another private port.

All unicast/broadcast/multicast layer2 traffic is blocked so it works much the
same way as using firewall rules but scales better and is generally easier as
firewall packages usually do not allow ARP blocking.

An example usage would be having a number of customers on separate vlans
bridged with a server network. All the vlans are marked private, they can all
communicate with the server network unhindered, but can not exchange any
traffic whatsoever with each other.

Approved by: re (rwatson)

updates for 802.11-related parameters

Reviewed by: thompsa
Approved by: re (hrs)

Add reporting and toggling of TCP LRO (large receive offload) support to
ifconfig(8).

Update for revised 802.11 support:
o revised channel handling support; ifconfig now queries the kernel to
find the list of available channels and handles channel promotion;
channel attributes can be specified as part of the channel; e.g. 36:a
for channel 36 in 11a (as opposed to turbo A or HT A)
o use channel list to map between freq and IEEE channel #; this eliminates
all knowledge of how the mapping is done and fixes handling of cases
where channels overlap in the IEEE channel # space but are distinct in
the frequency+attributes space (e.g. PSB)
o add new knobs: bgscan, ff (Atheors fast frames), dturbo (Atheros
Dynamic Turbo mode), bgscanidle, bgscanintvl, scanvalid, roam:rssi11a,
roam:rssi11b, roam:rssi11g, roam:rate11a, roam:rate11b, roam:rate11g
(roaming parameters), burst, doth (forthcoming 11h support)
o print contents of WME, ATH, WPA, RSN, information elements with -v option
o print signal strength in dBm
o print noise floor in dBm
o add list txpow to print tx power caps/channel
o change default channel display in status to be more informative

Add the -n flag for disabling automatic module loading, this will be used by
rc.d to stop it reloading the network module on unload.

Rename the trunk(4) driver to lagg(4) as it is too similar to vlan trunking.

The name trunk is misused as the networking term trunk means carrying multiple
VLANs over a single connection. The IEEE standard for link aggregation (802.3
section 3) does not talk about 'trunk' at all while it is used throughout IEEE
802.1Q in describing vlans.

The lagg(4) driver provides link aggregation, failover and fault tolerance.

Discussed on: current@

Bump document date for new trunk commands.

Hook trunk(4) up to the build.

Correct the name of the 'proto' command.

MFC after: 3 days

Be explicit in examples about the correct grammar for 'alias' and
'-alias', and that 'add' and 'delete are in fact synonyms for these
in the ifconfig(8) grammar.

Use network prefixes explicitly specified in IETF RFCs for
documentation purposes. (bz)

PR: 102701
MFC after: 1 day
See also: RFC 3330, RFC 3849
Submitted by: bz

Add an EXAMPLES section to ifconfig(8), clearly showing how to configure
IPv6 addresses in FreeBSD.

See also: http://www.telscom.ch/index.php/downloads/configure_ipv6_features

MFC after: 1 week
PR: 102701
Obtained from: OpenBSD (partly, with edits)

- Display the media instance numbers and allow the user to set the active
one. This is based on NetBSD but unlike NetBSD this implementation prints
the instance number for all media instances and doesn't skip it for the
first one as I don't see a reason to suppress it except for the vague
reason to preserve the output for single-instance configurations.
- Fix some whitespace nits.

These days P2P means peer-2-peer (also well known from serveral filesharing
protocols) while PointToPoint has been PtP links. Change the variables
accordingly while the code is still fresh and undocumented.

Requested by: bz

Add descriptions for p2p and autop2p.

Bump .Dd for r1.127.

Keep the command name the same as the values display name in ifconfig.

Add a new address cache type called sticky. On an interface marked sticky any
address learned by the bridge is made permanent, the address will not age out
and most importantly will not migrate to another interface.

This can be used to stop mac address poisoning or clients roaming in much the
same way as static entries without the hassle of preloading the table.

Bring in support for the Rapid Spanning Tree Protocol (802.1w).

RSTP provides faster spanning tree convergence, the protocol will exchange
information with neighboring switches to quickly transition to forwarding
without creating loops. The code will default to RSTP mode but will downgrade
any port connected to a legacy STP network so is fully backward compatible.

Reviewed by: syrinx
Tested by: syrinx

Fix markup botched in previous commit.

Note that the -v option may be used to expand long SSIDs.

PR: 102118
Reviewed by: sam

Correct some grammos.

Markup fixes.

Make TSO (TCP segmentation offload) capabilities visible and accessible with
'ifconfig em0 tso' and 'ifconfig em0 -tso'. TSO for IPv4 and IPv6 is always
enabled or disabled together. The driver may enable only one if it doesn't
support both.

Document 'tso' and '-tso' in the ifconfig(8) man pages.

Sponsored by: TCP/IP Optimization Fundraise 2005

add beacon miss threshold control

Submitted by: Henrik Brix Andersen <henrik@brixandersen.dk>
MFC after: 2 weeks

remove display of the ERP ie from the list sta output (it's always
zero); replace it with station capabilities

MFC after: 1 month

Import interface groups from OpenBSD. This allows to group interfaces in
order to - for example - apply firewall rules to a whole group of
interfaces. This is required for importing pf from OpenBSD 3.9

Obtained from: OpenBSD (with changes)
Discussed on: -net (back in April)

Document the rest of the 802.11 capability flags.

explain what list chan displays

MFC after: 1 week

add miss args to mac:del and mac:kick

Submitted by: Anders Hanssen
MFC after: 3 days

Document carp(4) arguments.

PR: docs/92653
Submitted by: Jeremy C. Reed <reed@reedmedia.net>
Reviewed by: ru
Approved by: trhodes (mentor)
MFC after: 5 days

document deftxkey

Document the pfsync(4) specific maxupd parameter, with text mostly taken
from OpenBSD's manpage.

PR: docs/89256
Submitted by: Pim van Pelt <pim at ipng dot nl>
MFC after: 3 days

add control for packet bursting

Add support for creating span ports so that one can snoop bridged traffic
from another interface/machine/network.

Obtained from: OpenBSD
MFC after: 2 weeks

add mcastrate support

MFC after: 1 week

-mdoc sweep.

Now ifconfig is the one right way to turn polling on. Thus, remove
the "if" clauses.

For the sake of consistency and easier typing,
introduce "-tunnel" as an alias for "deletetunnel".
The latter is overly long and prone to typos, but
keep it for POLA since it costs nothing.

MFC after: 5 days

Forgot to touch .Dd in the previous commit.

Deprecate the useless argument to -vlandev.

Submitted by: Fredrik Lindberg <fli+freebsd-current at shapeshifter.se> (implementation)
Reviewed by: brooks
MFC after: 5 days

Since special interface types get their own subsections
(not in mdoc(7) sense yet) in ifconfig(8) manpage, create such
subsections for gif(4) and vlan(4) so that their specific
options are not mixed up with general options.

Document two missed if_bridge commands 'addr' and 'static'.

Noticed by: Michal Mertl
Approved by: mlaier (mentor)
MFC after: 3 days

add list mac and mac:kick support

Submitted by: Michal Mertl (original version)
MFC after: 2 weeks

Wireless suport fixups: add a bunch of stuff that's been in the
code but not documented (e.g. wme, mac acl) and correct some
information, etc.

Reviewed by: brueffer

Add a new flag '-k' to ifconfig(8), indicating that it is alright to
print potentially sensitive keying material to stdout. With the new
802.11 support, ifconfig(8) is now capable of printing 802.11 keys,
and did by default for the root user, which is undesirable in some
environments. Now it will not print keying material unless requested
(and available to the user).

MFC after: 1 week

mdoc cleanup and whitespace removal after the last commit.

Submitted by: ru

Information about the capability flags in 'ifconfig foo0 scan' output.

Most content by: avatar
Reviewed by: sam
Approved by: re (hrs)
MFC after: 3 days

add pureg/-pureg parameter for controlling pureg ap mode support

Reviewed by: avatar
Approved by: re (scottl)

Markup fixes.

Approved by: re (blanket)

It's spelled 'preceded' of course.

Submitted by: David Adam <zanchey@ucc.gu.uwa.edu.au>
Pointy hat to: brueffer

Hex strings are _pre_ceeded by 0x, not _pro_ceeded.

PR: 82187
Submitted by: Anthony Rogers <anthony.j.rogers@gmail.com>
Approved by: re (blanket)
MFC after: 3 days

Connect if_bridge to the build.

Approved by: mlaier (mentor)

Xref carp(4) and polling(4).

MFC after: 3 days

Sort sections.

Scheduled mdoc(7) sweep.

Overhaul to cleanup some of the tangled logic that's grown over the years.

o break per-address family support out into separate files
o modularize per-address family and functional operations using
a registration mechanism; this permits configuration according
to which files you include (but beware that order of the files
is important to insure backwards compatibility)
o many cleanups to eliminate incestuous behaviour, global variables,
and poor coding practices (still much more to fix)

The original motivation of this work was to support dynamic addition
of functionality based on the interface so we can eliminate the various
little control programs and so that vendors can distribute ifconfig
plugins that support their in-kernel code. That work is still to be
completed.

o Update 802.11 support for all the new net80211 functionality; some
of these operations (e.g. list *) may be better suited in a different
program

First there was an -m option.
Then Peter killed it and made it the default.
Then Brooks and Poul-Henning added it again.
Then Ruslan fixed the manpage...

Bump the date, .Dd, since the document content has been changed
in the previous commit.

Pointed out by: ru

Add two knobs to ifconfig(8), `vlanmtu' and `vlanhwtag',
that provide control over the respective capabilities
of an interface, reception of extended frames and hardware
VLAN multiplexor.

Mechanically kill hard sentence breaks.

mdoc(7) police

Submitted by: ru

Wordsmith the BUGS section re: IPv6 link-local addresses.

PR: docs/66541
Submitted by: Michel Lavondes (with some cleanups/additions)

Assorted markup, grammar, and spelling fixes.

Document that -m also causes the capability list to be displayed.

Added the new interface capability option for drivers that implement
user-configurable polling(4) support. Make ifconfig(8) aware of it.

Suggested by: luigi

Remove advertising clause from University of California Regent's license,
per letter dated July 22, 1999.

Approved by: core, imp

add support for setting 802.11 rtsthreshold, transmit power,
and 11g protection mode

Reviewed by: imp (just code)

We can cross-reference to vlan(4) as long as
the corresponding manpage has been committed.
The rest of "vlan" words, which are refering
to the technology itself, should be capitalized.

MFC after: 1 week

The hardware tagging capability is set on the physical
interface that is parent to a vlan(4) interface,
not on the vlan(4) interface itself.

Add ifconfig support for network interface renaming. In the process,
reorganize the printing of the interface name when using wildcard
cloning so it is not printed if it we either immediately rename or
destroy the interface.

Reviewed by: ru

By popular demand, added the "static ARP" per-interface option.

mdoc(7) police: fix more breakages from rev. 1.69.

Fix broken comment line introduced in rev 1.69.

Found with: nroff -mandoc ifconfig.8 > /dev/null

document mode directive

Uncomment the description of the ipdst parameter, but refer to IPX
instead of NS.

Document the rxcsum and txcsum commands.

Submitted by: jlemon

mdoc(7) police: markup, spelling.

Also fixed a critical bug made in revision 1.62 by phk@.

update vlandev description; vlan code now auto-recognizes devices that
support h/w tagging

Remove a line that reflected behavior that does not actually exist.

Obtained from: TrustedBSD Project
Sponsored by: DARPA, NAI Labs

Document the `maclabel' command.

Obtained from: TrustedBSD Project
Sponsored by: Network Associates Laboratories

Add the "Monitor" interface flag.

Setting this flag on an ethernet interface blocks transmission of packets
and discards incoming packets after BPF processing.

This is useful if you want to monitor network trafic but not interact
with the network in question.

Sponsored by: http://www.babeltech.dk

Implement user-setable promiscuous mode (a new `promisc' flag for ifconfig(8)).
Also, for all interfaces in this mode pass all ethernet frames to upper layer,
even those not addressed to our own MAC, which allows packets encapsulated
in those frames be processed with packet filters (ipfw(8) et al).

Emphatically requested by: Anton Turygin <pa3op@ukr-link.net>
Valuable suggestions by: fenner

mdoc(7) police: KAMEism in rev. 1.56, nits in rev. 1.58.

Warn that hex keys are the most portable.

Submitted by: Gregory Bond <gnb@itga.com.au>
Pr: 40872

The .Nm utility

Add eui64 option which fills interface index (lowermost 64bit of
an IPv6 address) automatically.
This should obsolete prefix(8).

Obtained from: NetBSD
MFC after: 2 weeks

Reword the ``alias'' description slightly. We must specify a non-conflicting
netmask - not necessarily 0xffffffff.

MFC after: 3 days

Turn "ether" address family into a generic "link" family
that could be used to set/get arbitrary length link level
addresses. Alias "lladdr" parameter and "ether" family
to the new "link" family for backward compatibility.

PR: bin/31476
MFC after: 1 week

mdoc(7) police: kill whitespace at eol.

Note what the default address_family is.

PR: 32463
Submitted by: Gary W. Swearingen

mdoc(7) police:

Restore (sorta) a useful piece of information that got lost in the
previous delta -- an ability to specify /prefixlength after an IPv6
address.

In the words of the submitter:

The first "synopsis" example has a "[/prefixlength]" which shouldn't
be there, since that stuff is part of the preceeding "address" as is
explained in the description of "address".

(The way it is now, 192.168.0.1/16/prefixlength would be a proper
operand. Note that "prefixlength" is not mentioned by name anywhere.)

PR: 32462
Submitted by: Gary W. Swearingen <swear@blarg.net>

Spelling police: sucessful -> successful.

Submitted by: Anders Andersson <anders@codefactory.se>

Spelling police: "more then" - "more than" where appropriate.

``create'' and ``destroy'' are command modifiers (.Cm), not flags (.Fl).

mdoc(7) police: restore markup bit that got accidentally lost in rev. 1.44.

Spelling.

mdoc(7) police: fix markup.

Support network device cloning via create and destroy options.

Reviewed by: ru, ume
Obtained from: NetBSD
MFC after: 1 week

Sync with recent KAME.
This work was based on kame-20010528-freebsd43-snap.tgz and some
critical problem after the snap was out were fixed.
There are many many changes since last KAME merge.

TODO:
- The definitions of SADB_* in sys/net/pfkeyv2.h are still different
from RFC2407/IANA assignment because of binary compatibility
issue. It should be fixed under 5-CURRENT.
- ip6po_m member of struct ip6_pktopts is no longer used. But, it
is still there because of binary compatibility issue. It should
be removed under 5-CURRENT.

Reviewed by: itojun
Obtained from: KAME
MFC after: 3 weeks

ARP works on networks other than Ethernet.

PR: 22062
Submitted by: Christian Weisgerber <naddy@mips.inka.de>,
Brooks Davis <brooks@one-eyed-alien.net>

Mention the 'ether' parameter.

PR: 23767
Submitted by: Maxime Henrion <mux@qualys.com>,
Brooks Davis <brooks@one-eyed-alien.net>

When using interfaces that support if_media, the supported media list is
printed on a single, very long, and generally unreadable line. This
isn't very useful. It's also really ugly and most of the time you don't
care what media is supported anyway.

PR: 27701
Submitted by: Brooks Davis <brooks@one-eyed-alien.net>

Currently, each wireless networking driver has it's own control program
despite the fact that most people want to set exactly the same settings
regardless of which card they have. It has been repeatidly suggested
that this configuration should be done via ifconfig. This patch
implements the required functionality in ifconfig and add support to the
wi and an drivers. It also provides partial, untested support for the
awi driver.

PR: 25577
Submitted by: Brooks Davis <brooks@one-eyed-alien.net>

Cosmetics: .Dl -> .Li.

Let ifconfig(8) catch up with the new functionality where
one can specify addresses and netmask in CIDR notation.

Submitted by: Dima Dorfman <dima@unixfreak.org>

mdoc(7) police: split punctuation characters + misc fixes.

mdoc police.

Submitted by: ru

Add 'netrange' parameter to 'range' command and fix a couple of typos.

PR: 23984
Submitted by: Jimmy Olgeni <olgeni@uli.it>

mdoc(7) police: use the new features of the Nm macro.

Show the actual command line usage in the man page and usage error string.

Note that "ether" is a supported address family for setting addresses.

Implement SIOCSIFLLADDR, which allows you to change the link-level
address on an interface. This basically allows you to do what my
little setmac module/utility does via ifconfig. This involves the
following changes:

socket.h: define SIOCSIFLLADDR
if.c: add support for SIOCSIFLLADDR, which resets the values in
the arpcom struct and sockaddr_dl for the specified interface.
Note that if the interface is already up, we need to down/up
it in order to program the underlying hardware's receive filter.
ifconfig.c: add lladdr command
ifconfig.8: document lladdr command

You can now force the MAC address on any ethernet interface to be
whatever you want. (The change is not sticky across reboots of course:
we don't actually reprogram the EEPROM or anything.) Actually, you
can reprogram the MAC address on other kinds of interfaces too; this
shouldn't be ethernet-specific (though at the moment it's limited to
6 bytes of address data).

Nobody ran up to me and said "this is the politically correct way to
do this!" so I don't want to hear any complaints from people who think
I could have done it more elegantly. Consider yourselves lucky I didn't
do it by having ifconfig tread all over /dev/kmem.

Document "-alias".

Remove single-space hard sentence breaks. These degrade the quality
of the typeset output, tend to make diffs harder to read and provide
bad examples for new-comers to mdoc.

Spelling: ``adress'' -> ``address''

Introduce ``add'' and ``remove'' as alternatives to ``alias'' and ``delete''.
Improve compatibility with BSD/OS, and also more accurately reflect that
IP aliases aren't really any different than the primary IP address on an
interface.

Reviewed by: dcs
Approved by: jkh

Fix various man pages to stop abusing the .Bx macro to generate
the strings "FreeBSD" and "NetBSD". Use the .Fx or .Nx macro
instead.

Spelling fix (manuall -> manual)

Submitted by: Jeroen C. van Gelderen <jeroen@vangelderen.org>

udp IPv6 support, IPv6/IPv4 tunneling support in kernel,
packet divert at kernel for IPv6/IPv4 translater daemon

This includes queue related patch submitted by jburkhol@home.com.

Submitted by: queue related patch from jburkhol@home.com
Reviewed by: freebsd-arch, cvs-committers
Obtained from: KAME project

Add comment about aliases on same subnet.

Submitted by: Martin Blapp <mbr@imp.ch>

$Id$ -> $FreeBSD$

Grrr... botched remote commit. Let's try this again: vlan updates,
take two.

Update man page to allow adding address_family when -l is used (this is a no op
for now). Correct use of .Nm. Short usage string (see man page for full list).
Spelling. Use err(3).

Fix typo: exit -> exist

Spell 'implements' correctly.

PR: 5614
Submitted by: Dag-Erling Coidan Smorgrav <dag-erli@ifi.uio.no>

Make the supported media info output the default.
The -m switch is now accepted for backwards compatability.

Suggested by: davidg

Spell out a few things for the media options.

Import Lite2's src/sbin, except for XNSrouted and routed. All relevant
files in src/sbin are off the vendor branch, so this doesn't change the
active versions.

Grab some of the NetBSD text for describing the new options and the
media commands.

Revert $FreeBSD$ to $Id$

Make the long-awaited change from $Id$ to $FreeBSD$

This will make a number of things easier in the future, as well as (finally!)
avoiding the Id-smashing problem which has plagued developers for so long.

Boy, I'm glad we're not using sup anymore. This update would have been
insane otherwise.

Sort cross references.

Just realised the man page didn't mention the appletalk specific options
to ifconfig..
so I 've added them..

Submitted by: Archie@whistle.com
Obtained from: Whistle Communications
patches to allow ifconfig to work with appletalk addresses etc.

XNS sort-of-support is no more.

Remove support for OSI networking in user-land (#ifdef OSI aor CCITT)
in preparation for its removal from the kernel source tree. NB: because
a function was deleted, libc is now at version 3.0 (was 2.2 previously).

Fix a bunch of spelling errors.

Impliment -ad and -au flags in addition to -a and document the change
in the man page. ifconfig -au affects all interfaces marked as up,
and ifconfig -ad affects only the interfaces marked down. ifconfig -a
still handles everything. This change is purely for compatibility with
SunOS, for those who might be accustomed to the SunOS ifconfig's
behavior.

Tweak the man page too.

Added support for setting the per-interface MTU.

BSD 4.4 Lite sbin Sources

Note: XNSrouted and routed NOT imported here, they shall be imported with
usr.sbin.